QEMU Guest Agent: symlink and TOCTOU flaws in SSH key injection give root inside the guest

Impact

qemu-ga runs as root inside the guest. An unprivileged guest user can pre-stage a directory symlink, or win a time-of-check/time-of-use race on a file symlink, so that a guest-ssh-add-authorized-keys call hands them ownership of an arbitrary root-owned file or directory - and from there, root in the guest. The escalation is guest-local: on its own it does not reach the host or another VM. For GPU clouds that rent whole VMs with passthrough accelerators the tenant is typically already root in their own VM, so the exposure is really on guests with multiple accounts - shared research VMs, multiuser images, or GPU VMs whose interactive users are deliberately kept unprivileged. The path only opens when an external management layer such as libvirt actually invokes the command.

Who can reach it

Local unprivileged user inside a guest running qemu-ga, on a platform where libvirt or another management layer calls guest-ssh-add-authorized-keys. No host or hypervisor access required.

What to do

Update the qemu-guest-agent package inside guest images and restart the agent. This is a guest-side package rather than a host QEMU update, so it rolls out with a golden-image refresh and per-guest restart - no hypervisor maintenance window and no GPU node reboot. Where images cannot be refreshed quickly, block the guest-ssh-add-authorized-keys command via the qemu-ga allow/block list. Red Hat's CVE page carries the per-RHEL fixed builds; the NVD record names no fixed version.

References

Related entries

• Linux kernel (net/xfrm, net/key): No memory corruption here, but a clean namespace boundary break. SA migrationCVE-2026-63914 · Linux kernel (net/xfrm, net/key)High
• Xen on AMD - x86 HVM pagetable height update: AMD HVM guest OS users can trigger a data-structure access during aCVE-2019-19577 · Xen on AMD - x86 HVM pagetable height updateHigh
• IBM Spectrum Scale kernel module: An unauthenticated local trigger takes down the Spectrum Scale kernel module and withCVE-2020-4411 · IBM Spectrum Scale kernel moduleHigh
• Xen - x86 IOMMU command timeout detection and handling: Xen's IOMMU command timeout handling is inappropriate, so IOMMUCVE-2021-28692 · Xen - x86 IOMMU command timeout detection and handlingHigh
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2021-4460 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Xen (x86): Unintended memory sharing between guests - cross-tenant data exposureCVE-2022-42327 · Xen (x86)High